Website security · WordPress · Joomla · Custom
Website security and maintenance plans
Hardening, daily vulnerability monitoring, tested updates and off-server backups, looked after by people who build websites for a living. Plans from $497 a month.
What does website security and maintenance include?
A proper plan covers security hardening, daily monitoring of your CMS and plugins for known vulnerabilities, tested (not automatic) updates, verified backups stored off the server, admin access control and a named person to call. Cyberstore plans start at $497 a month, with a one-off update service for $479.
Why websites get hacked
Most of the hacked websites we clean up were broken into through something simple: a plugin that was six months out of date, an admin account with a reused password, or a site nobody had touched since launch. Automated scanners find those weaknesses within hours of a vulnerability being published.
A proper security and maintenance plan closes those gaps before they are found, keeps verified backups off the server, and means someone who knows your site is watching it.
Signs your site needs attention now
- The CMS or plugins have not been updated in 30 days or more
- Nobody is sure where the latest backup is, or whether it restores
- Former staff or contractors still have admin logins
- Admin logins do not use multi-factor authentication
- Updates are left to "auto" and nobody checks after
// What is included
Everything a business website needs to stay secure and online
Verified off-server backups
Database and full-system backups stored away from your hosting, plus a full backup before every update so we can roll back safely.
Hardening at day one
A full security audit when your plan starts: permissions, configuration, user roles, vulnerable extensions and our Website Security Checklist.
Daily vulnerability monitoring
Your CMS and every installed extension checked against published vulnerability lists and developer security announcements.
Safe, tested updates
No blind auto-updates. High-risk patches within 24 to 48 hours, everything tested against your working site, with manual rollback if needed.
Access control
Admin accounts reviewed, unused accounts removed, MFA enforced where the platform supports it, and login protection in place.
Priority support
Direct access to Noah and the team by phone and email during business hours, with guaranteed response times.
// Plans
Website security and maintenance plans
Basic Essentials
Core protection, backups and updates for stable, secure websites.
$497/ month
- Quarterly full backup (files and database)
- Monitoring of plugin releases and security updates
- CMS kept on the latest stable version
- Standard response within 48 hours
- Support and incident remediation quoted separately
Best for: simple brochure sites with low change.
Book a consultProfessional
Proactive security, maintenance and priority support.
$749/ month
- Secure hosting on a private Australian server
- Daily database backup and monthly full backup, stored offline
- Security audit at commencement
- Disaster recovery plan implemented
- Full hardening to our Security Checklist
- All plugins monitored and updated
- Priority same-day response and phone support
- 1 hour of production or consulting time each month
Best for: sites that generate enquiries, sales or hold member data.
Start a planEnterprise
Custom response times and remediation for complex or mission-critical systems.
POA
- Everything in Professional
- Custom response SLAs
- Advanced hardening and compliance support
- Extended production and advisory time
- Multi-site and legacy platform support
Best for: portals, eCommerce and multi-site estates.
Discuss requirementsPrefer a one-off? Our Backup, Update and Testing service is $479 one-time: backup before changes, CMS and extension updates where compatible, basic regression testing and a summary of actions and recommendations. "Starting at" pricing applies where scope, extension footprint or legacy configuration needs extra remediation.
The Hack Attack Guarantee
If your website was built by our team, has been covered by an active Security and Maintenance plan from the day it went live, and has had no unauthorised code changes, we will repair any hacking damage completely free of charge. That includes restoring clean files and making every code fix needed.
We can offer this because prevention works. It is also why we are fussy about doing updates properly.
Already hacked? Skip the plan for now and go straight to hacked website repair, or call 1300 566 652.
// FAQ
Common questions
Why not just turn on automatic updates?
Automatic updates on a live site break a percentage of websites, usually at the worst possible time, and they do nothing about abandoned plugins, weak admin accounts or missing backups. We back up first, test updates, apply them carefully and roll back if anything misbehaves.
Which platforms do you look after?
WordPress, Joomla and most established PHP-based platforms, plus custom web applications. We are also comfortable with older or heavily customised sites where a simple plugin scan is not enough.
Do I need to move my hosting to you?
No. We can secure and maintain a site wherever it is hosted. Our Professional plan includes hosting on a private Australian server if you would like everything in one place.
What is the Hack Attack Guarantee?
If we built your website and it has been on an active Security and Maintenance plan since launch with no unauthorised code changes, we repair any hacking damage at no charge. Very few providers offer this.
How quickly are critical patches applied?
High-risk security patches are applied within 24 to 48 hours of release. Standard updates are applied before the next service month, after testing.
// Keep going
Related services
Hacked Website Repair
Hacked website? We investigate, remove malware and backdoors, close the entry point and harden WordPress, Joomla and custom sites. Perth, since 2008.
Vulnerability Scanning & Pen Testing
Vulnerability scanning, web app testing and penetration testing for Perth organisations, with clear reports, fixes and retests.
Email Security & DMARC
Stop email spoofing and invoice fraud. We set up SPF, DKIM and enforced DMARC, harden Microsoft 365 and fix email deliverability for Perth organisations.
// Next step
Talk to us about Website Security & Maintenance
Tell us what you run and what you are worried about. We will come back within one business day and, if it helps, send you a fixed-price quote.
- No-obligation first consult
- Fixed scope and price before work starts
- A clear written report and next steps
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
